Storage of data in encrypted form has often been used to preserve secrecy of highly classified government data. More recently there has been an increasing need for businesses to preserve sensitive customer data such as trade secrets, credit card numbers, and medical records. Storage of encrypted data on a data storage device such as a disk drive not only protects against theft of information if the data storage device is stolen, but also protects against inadvertent disclosure if the data storage device is not erased when it is re-configured for another user or retired from service.
A number of encryption techniques have been standardized, and some have been designed for encrypting stored data. One well-known standard encryption technique is the Advanced Encryption Standard (AES) described in the Federal Information Processing Standards (FIPS) Publication 197 published Nov. 26, 2001, by the United States National Institute of Standards and Technology (NIST), Gaithersburg, Md. AES uses a symmetric cryptographic key of 128, 192, or 256 bits to encrypt and decrypt data in blocks of 128 bits.
To encrypt a string of plaintext blocks, a selected encryption mode is layered over AES. Standard encryption modes often layered over AES include the Cipher Block Chaining (CBC) mode, and the XTS mode.
In CBC mode, each plaintext block is exclusive-OR'd with the previous ciphertext block before the plaintext block is encrypted. The first plaintext block in the string is exclusive-OR'd with a pre-selected initialization vector. Decryption is a reverse of this process.
The XTS mode has been designed for encrypting data stored on disk or tape. The XTS mode is described in the Institute for Electrical and Electronic Engineers (IEEE) P1619/D16 Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices (May 2007), IEEE, Piscataway, N.J. In addition to the encryption key used by the AES block cipher, XTS layered over AES (XTS-AES) uses a “tweak key” to incorporate the logical position of the data block into the encryption. XTS-AES addresses threats such as copy-and-paste and dictionary attacks, while allowing parallelization and pipelining in cipher implementations.
Encryption of data for storage and decryption of data upon recall from storage requires some additional data processing resources. More troubling is the fact that encryption affects the reliability of data storage. Use of an improper key during encryption or loss of the proper key for decryption will cause the data to become unavailable or lost. Encryption may also interfere with standard methods of checking and testing data integrity.
To avoid using corrupted keys, some measures should be taken to verify the integrity of the keys in use. One method for ensuring key integrity is by using a “key signature.” For example, this could be a Keyed-Hash Message Authentication Code (HMAC) computed over the cipher key using some higher-level key. In a similar fashion, the integrity of the stored ciphertext can be verified by using a HMAC key to compute a Message Authentication Code (MAC) over the ciphertext, and by storing the MAC with the ciphertext so that the MAC can be verified upon recall of the stored ciphertext. These integrity verification techniques are described in the IEEE P1619.1/D20 Draft Standard for Authenticated Encryption with Length Expansion for Storage Devices (June 2007), IEEE, Piscataway, N.J., and the IEEE P1619.3/D1, Draft Standard for Key Management Infrastructure for Cryptographic Protection of Stored Data (May 2007), IEEE, Piscataway, N.J. The HMAC is further described in FIPS Publication 198, The Keyed-Hash Message Authentication Code (HMAC), Mar. 6, 2002, National Institute of Standards and Technology, Gaithersburg, Md.